ci-kickoff-manual.yml

name: CI Kickoff Manual

on:
  workflow_dispatch:
    inputs:
      commit-sha:
        description: 'The commit SHA to run the workflow on (must be the head commit of the PR)'
        required: true
        default: ''
      pr-number:
        description: 'The PR number' # this is used for posting comments with the CI link
        required: true
        default: ''
      confirm:
        description: 'Check this box to confirm you have reviewed the PR at the specified commit'
        required: true
        type: boolean

jobs:
  verify-inputs-and-get-pr-refs:
    name: Verify Inputs and Get PR Refs
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      base-ref: ${{ steps.fetch.outputs.base_ref }}
      head-ref: ${{ steps.fetch.outputs.head_ref }}
      head-repo: ${{ steps.fetch.outputs.head_repo }}
    steps:
      - name: Verify Commit Is PR Head and Fetch PR Refs
        id: fetch
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        env:
          PR_NUMBER: ${{ inputs.pr-number }}
          COMMIT_SHA: ${{ inputs.commit-sha }}
          CONFIRM: ${{ inputs.confirm }}
        with:
          script: |
            // For boolean workflow_dispatch inputs, 'required: true' does not
            // enforce that the box is ticked, so check it here.
            if (process.env.CONFIRM !== 'true') {
              core.setFailed('confirm must be checked: it acknowledges that you reviewed ' +
                             'the PR at the specified commit');
              return;
            }

            // Match on the raw string: Number() would also accept forms like
            // '0x10', '1e3' or ' 12 ', which would target a different PR.
            if (!/^[1-9][0-9]*$/.test(process.env.PR_NUMBER || '')) {
              core.setFailed(`pr-number must be a positive decimal integer, got: ${process.env.PR_NUMBER}`);
              return;
            }
            const prNumber = Number(process.env.PR_NUMBER);
            const sha = (process.env.COMMIT_SHA || '').toLowerCase();
            if (!/^[0-9a-f]{40}$/.test(sha)) {
              core.setFailed('commit-sha must be a full 40-character commit SHA');
              return;
            }

            const { data: pr } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: prNumber
            });
            if (pr.state !== 'open') {
              core.setFailed(`PR #${prNumber} is ${pr.state}, refusing to run CI on it`);
              return;
            }

            // Require the head commit: the confirm checkbox states the PR was
            // reviewed at this commit, and an older commit of the PR would run
            // CI on code that is no longer what the PR proposes to merge.
            if (sha !== pr.head.sha.toLowerCase()) {
              core.setFailed(`Commit ${sha} is not the head of PR #${prNumber} ` +
                             `(head is ${pr.head.sha}). Re-run with the head commit.`);
              return;
            }

            // Empty if the fork was deleted after the PR was opened. Jobs that
            // push to the head branch compare this against github.repository and
            // skip the push unless the branch lives in this repository.
            const headRepo = pr.head.repo ? pr.head.repo.full_name : '';
            core.info(`PR #${prNumber} base ref: ${pr.base.ref}, ` +
                      `head ref: ${pr.head.ref}, head repo: ${headRepo}`);
            core.setOutput('base_ref', pr.base.ref);
            core.setOutput('head_ref', pr.head.ref);
            core.setOutput('head_repo', headRepo);

  ci-main:
    name: CI Main
    needs: [verify-inputs-and-get-pr-refs]
    uses: ./.github/workflows/ci-main.yml
    secrets: inherit
    with:
      commit-sha: ${{ inputs.commit-sha }}
      release-build: 'false'
    permissions:
      actions: write
      contents: read
      id-token: write
      pull-requests: read

  ci-pr-only:
    name: CI PR Only
    needs: [verify-inputs-and-get-pr-refs]
    uses: ./.github/workflows/ci-pr-only.yml
    secrets: inherit
    with:
      commit-sha: ${{ inputs.commit-sha }}
      base-ref: ${{ needs.verify-inputs-and-get-pr-refs.outputs.base-ref }}
      head-ref: ${{ needs.verify-inputs-and-get-pr-refs.outputs.head-ref }}
      head-repo: ${{ needs.verify-inputs-and-get-pr-refs.outputs.head-repo }}
      pr-number: ${{ inputs.pr-number }}
    permissions:
      contents: read
      pull-requests: write

  post-required-check-status-ci-main:
    name: CI Main Required Check Status
    runs-on: ubuntu-latest
    needs: [ci-main]
    if: success() || failure()
    permissions:
      contents: read
      pull-requests: write
      statuses: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.commit-sha }}
      - uses: ./.github/actions/post-commit-status
        with:
          commit-sha: ${{ inputs.commit-sha }}
          run-result: ${{ needs.ci-main.result }}
          name: ci-main-status

  post-required-check-status-ci-pr-only:
    name: CI PR Only Post Required Check Status
    runs-on: ubuntu-latest
    needs: [ci-pr-only]
    if: success() || failure()
    permissions:
      contents: read
      pull-requests: write
      statuses: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.commit-sha }}
      - uses: ./.github/actions/post-commit-status
        with:
          commit-sha: ${{ inputs.commit-sha }}
          run-result: ${{ needs.ci-pr-only.result }}
          name: ci-pr-only-status

  post-comment-with-ci-link:
    name: Post Comment with CI Link
    runs-on: ubuntu-latest
    needs: [verify-inputs-and-get-pr-refs]
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Add PR Comment
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        env:
          PR_NUMBER: ${{ inputs.pr-number }}
          COMMIT_SHA: ${{ inputs.commit-sha }}
        with:
          script: |
            // Both inputs were validated by verify-inputs-and-get-pr-refs, which
            // this job depends on.
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}` +
                           `/actions/runs/${context.runId}`;
            const message = `Run on ${process.env.COMMIT_SHA} URL: ${runUrl}\n\n`;

            await github.rest.issues.createComment({
              issue_number: Number(process.env.PR_NUMBER),
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: message
            });

  notify-slack-new-workflow-run:
    name: Notify Slack for new External Contributor Workflow Run
    runs-on: ubuntu-latest
    needs: [verify-inputs-and-get-pr-refs]
    steps:
      - name: Post to a Slack channel
        id: slack
        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
        with:
          channel-id: ${{ secrets.EXT_WORKFLOW_RUN_CHANNEL }} # for security reasons, keep this masked
          slack-message: "External Contribution Workflow Run Started: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}>"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_API_TOKEN }}